k6-playwright-converter
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADS
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill instructs the agent to include imports from
jslib.k6.io(e.g.,https://jslib.k6.io/k6-testing/latest/index.js) in generated scripts. These are official, well-known libraries maintained by the k6/Grafana community for performance testing utilities. - [COMMAND_EXECUTION]: The skill performs environment preparation using shell commands (
mkdir -p k6/scripts) and executes generated scripts through a dedicated tool (mcp_k6_run_script). These operations are necessary for the skill's primary function of local script development and testing. - [INDIRECT_PROMPT_INJECTION]: The skill's primary function involves processing untrusted user data (Playwright scripts) to generate executable code.
- Ingestion points: User-supplied Playwright scripts are ingested in Step 1 for analysis and conversion.
- Boundary markers: No specific boundary markers or instructions to ignore embedded commands within the input scripts are defined.
- Capability inventory: The skill possesses file-write capabilities (Step 6) and script execution capabilities via
mcp_k6_run_script(Step 9). - Sanitization: No explicit sanitization or validation of the input script's content is mentioned beyond functional conversion logic.
Audit Metadata